About jcandelaria

Check the compatibility matrix. MacOs 12.x is officially supported... https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent.html#where-can-i-install-the-cortex-xdr-agent ... View more

Hi Orkan, I would say, it depends on the organizations change control and upgrade strategy. Some environment that i worked with, have auto upgrade enabled and some have more conservative approach. Basically there is canary/pilot group (IT group themselves) have auto upgrade setup for certain # of weeks for evaluation and testing,  then next change control after is where they will roll out the auto upgrade setting.  Also you still have options below depending on your strategy (upgrade process)     ... View more

Hi Vudoo408,   Let me answer your question directly first then follow up with additional questions and solution. 🙂 With regards to standalone agent installer, you can check the link below (Install or Update Agents Using Installer and Content Package Manually) https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-bundle   Follow up questions: with regards to satellite facilities, are they air gapped environment or they have access to internet directly? If they have then technically as long as the required communication ports/fqdn are open then agents should be able to check-in If they are air gapped, would setting up broker vm on those satellite facilities an option? https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/activate-the-agent-proxy-for-closed-networks.html   Q:The two VM shows to be checked in and communicating with the trap server but is showing to be disabled. A:(need to check the policy and profile assigned to the agent whether modules are enabled). Also try installing the latest agent, 7.5.1 instead.   Q: The physical Win 10 refuses to connect to the server at all.  most common culprit are: A: firewall (either ports are not open from network segment or endpoint firewall itself is blocking) A: doesnt have updated certificate  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr You can also submit a support case for PA support to analyze the logs Once you open/double click the xdr agent icon and open the xdr agent console from the bottom right corner of your screen. You can click the generate tech support file  which will grab the needed support files and output in zip file which you can attach to the case,  as alternative if generating tech support file doesn't work, You should be able to see Open Log File, copy/upload that log file on the case.   ... View more

Hi KirkH,   Try the solution posted here.... https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/reconnect-disconnected-xdr-clients-remotely-an-easy-way/m-p/420905#M881   If it continues to disconnected and many are affected of the same reconnect-disconnected pattern, kindly submit a support case so PA support can investigate further on the root cause.. ... View more

Hi BocolP,   Yes please update the thread so anyone in our live community can use this thread as a future reference if scenario exist. ... View more

@Alexandre_Jodoin  Please work with support on this one, using 20GB is really really really too high. This needs to be investigate thoroughly.. They probably need to look deeper at the low level logs on this one. ... View more

Hi BocolP,   Its not in the registry to check whether the agent is flag as vdi. Its on agent_settings.db. You have to use cytool command "cytool persist print agent_settings.db" then you will be able to see if the machine is installed as vdi and you will also see the golden image agent id.  Your issue is most likely during the publication process where it doesnt take the OS base layer configuration changes of the image. I would suggest once you edit the OS image (install xdr as vdi enabled), save it first then edit again then do whatever task then save it again then publish. You can double check the setting by using the cytool command above to check if it has the right setting. If it has then you can publish again.  If its still not taking it, then something is reverting the OS level changes you made during the publication. ... View more

Hi John_Acoba,   I assume you went and follow the guide below already? What version of the agent that keeps getting listed on the same tenant? Is this happening to all agents or only certain versions?   https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/manage-cortex-xdr-agents/move-cortex-xdr-agents-between-managing-xdr-servers   ... View more

Hi Felixcao, How many endpoints can be added? What percentage of the order? I apologize but you have to consult your account team on this one. If the order number is exceeded, after 14 days, if there is no new license, is the newly installed endpoint or random disconnected. what will happen on the newly installed agents status will have disconnected status. If one of the 200 connected agent shutdown the machine then the 201 agent will get connected since there is available license. Then the previously shutdown agent when it boots up now will get the disconnected status.    I would highly advise to engage with your account team to get the proper licensing count to avoid the scenario above. ... View more

Hi Chukaokonkwo,   I'm not sure whats your reasonable price range but if you want to, you can engaged with professional services offering below with your account team.. https://www.paloaltonetworks.com/resources/datasheets/service-description-optimization-service-for-cortex-xdr   ... View more

Hi Felixcao,   " Cortex XDR permits a small grace over the permitted number but begins enforcing the number of agents after 14 days. If additional Pro agents are required, increase your Cortex XDR Pro per Endpoint license capacity."   At the same time, after 14 days, if there is no add new license, the no:201 terminal will lose the link and lose the prevent function. Is this correct? Yes   So contact your account team as soon as possible to get additional licenses ... View more

Hi CraigV123,   So server is still an issue on high memory? how much memory are you seeing constantly on that backup servers? ... View more